Moodle: moodle: authentication bypass via lti provider allows suspended users to gain unauthorized access. (moodle)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.42 % · percentile 36 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- fedora
- NVD status
- Analyzed
Description
A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) Provider. The issue arises from the LTI authentication handlers failing to enforce the user's suspension status, enabling unauthorized access to the system. This can lead to information disclosure or other unauthorized actions by users who should be restricted.
Weaknesses (CWE)
- CWE-280 — Improper Handling of Insufficient Permissions or Privileges
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | fedora |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | NVD · patrick@puiterwijk.org (Secondary) |
Advisories
- GHSA-j5jv-w5cw-j9ff — Moodle authentication bypass vulnerability
European references
- ENISA EUVD · EUVD-2025-206738
- GCVE · GCVE-0-2025-67848
CERT-FR advisories
- CERTFR-2025-AVI-1113 — Multiples vulnérabilités dans Moodle · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*< 4.1.22cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*≥ 4.4.0 < 4.4.11cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.8cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*≥ 5.0.0 < 5.0.4cpe:2.3:a:moodle:moodle:5.1.0:-:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| moodle | affected 4.1.0 < 4.1.22 ; affected 4.4.0 < 4.4.12 ; affected 4.5.0 < 4.5.8 ; affected 5.0.0 < 5.0.4 ; affected 5.1.0 < 5.1.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |